Microsoft security alert.
February 14, 2023
Advisory overview
Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 71 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.
Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.
Vulnerability details
Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:
-
Microsoft Office Security Update for February 2023
- Severity
- Critical 4
- Qualys ID
- 110426
- Vendor Reference
- KB5002309, KB5002313, KB5002316, KB5002323
- CVE Reference
- CVE-2023-21714, CVE-2023-21715, CVE-2023-21716, CVE-2023-21721, CVE-2023-21823
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
Microsoft has released February 2023 security updates to fix multiple security vulnerabilities.
This security update contains the following:
Office Click-2-Run and Office 365 Release Notes
Release notes for Office for Mac
KB5002316
KB5002309
KB5002313QID Detection Logic:
This authenticated QID checks the file versions from the Microsoft advisory with the versions on the affected office system.Note: Office click-2-run and Office 365 installations need to be updated manually or need to be set to automatic update. There is no direct download for the patch.
Following keys are used in the detection. HKLM\SOFTWARE\Microsoft\Office.0\Common\InstallRoot\Path HKLM\SOFTWARE\Wow6432Node\Microsoft\Office.0\Common\InstallRoot\Path HKLM\SOFTWARE\Wow6432Node\Microsoft\Office.0\Common\InstallRoot\Path HKLM\SYSTEM\CurrentControlSet\Services\WACSM\ImagePath HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Office15.WacSERVER\InstallLocation HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration\InstallationPath HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration\InstallationPath
- Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Office Click-2-Run and Office 365 Release Notes
Release notes for Office for Mac
KB5002316
KB5002309
KB5002313Patches:
The following are links for downloading patches to fix these vulnerabilities:
Microsoft Office Information Disclosure Vulnerability
Microsoft OneNote Elevation of Privilege Vulnerability
Microsoft Publisher Security Features Bypass Vulnerability
Microsoft Word Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability
-
Microsoft SharePoint Server and Foundation Update for February 2023
- Severity
- Critical 4
- Qualys ID
- 110427
- Vendor Reference
- KB5002312, KB5002325, KB5002330, KB5002342, KB5002346, KB5002347, KB5002350, KB5002352, KB5002353
- CVE Reference
- CVE-2023-21716, CVE-2023-21717
- CVSS Scores
- Base 10 / Temporal 8.3
- Description
-
Microsoft has released February 2023 security updates to fix multiple security vulnerabilities.
This security update contains the following KBs:
KB5002347
KB5002312
KB5002353
KB5002342
KB5002330
KB5002346
KB5002350
KB5002325
KB5002352
QID Detection Logic:
This authenticated QID checks the file versions from above Microsoft KB article with the versions on affected SharePoint system. - Consequence
-
Successful exploitation allows an attacker to execute code remotely.
- Solution
-
Refer to Microsoft Security Guidance for more details pertaining to this vulnerability.
KB5002347
KB5002312
KB5002353
KB5002342
KB5002330
KB5002346
KB5002350
KB5002325
KB5002352
Patches:
The following are links for downloading patches to fix these vulnerabilities:
February 2023
-
Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability for February 2023
- Severity
- Critical 4
- Qualys ID
- 50125
- Vendor Reference
- CVE-2023-21529, CVE-2023-21706, CVE-2023-21707, CVE-2023-21710
- CVE Reference
- CVE-2023-21529, CVE-2023-21706, CVE-2023-21707, CVE-2023-21710
- CVSS Scores
- Base 8.3 / Temporal 6.5
- Description
-
Microsoft Exchange Server 2013, 2016 and 2019 are affected by multiple vulnerabilities.
KB Articles associated with this update are: KB5023038
Affected Versions:
Microsoft Exchange Server 2013 Cumulative Update 23
Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 11
Microsoft Exchange Server 2019 Cumulative Update 12QID Detection Logic (Authenticated):
The QID checks for vulnerable version of Microsoft Exchange Server by checking the file version of Exsetup.exe. - Consequence
-
Successful exploitation of the vulnerability may allow remote code execution
- Solution
-
Microsoft has released patch, customers are advised to refer to KB5023038 for information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5023038
-
Microsoft 3D Builder Remote Code Execution (RCE) Vulnerability for February 2023
- Severity
- Critical 4
- Qualys ID
- 91975
- Vendor Reference
- CVE-2023-23377, CVE-2023-23390
- CVE Reference
- CVE-2023-23377, CVE-2023-23390
- CVSS Scores
- Base 7.2 / Temporal 5.3
- Description
-
3D Builder is an application to View, Create, and Personalize 3D objects.
Microsoft has released a security update to 3D Builder Application to address a remote code execution vulnerability.Affected Versions:
3D Builder Version prior to 20.0.3.0QID Detection Logic:
This QID gets the version of 3D Builder by querying wmi class Win32_InstalledStoreProgram. - Consequence
-
An attacker can perform a Remote Code Execution Vulnerability on a vulnerable version of 3D Builder.
Note: Even though the attack vector is local, Microsoft classified this as a Remote Code Execution Vulnerability because an attacker may exploit this through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.
- Solution
-
Customers are advised to install latest version of Application from 3D Builder Application.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
3D Builder Application
-
Microsoft .NET Framework Security Update for February 2023
- Severity
- Serious 3
- Qualys ID
- 91977
- Vendor Reference
- KB5022497, KB5022503, KB5022727, KB5022728, KB5022729, KB5022730, KB5022731, KB5022732, KB5022733, KB5022734, KB5022735, KB5022782, KB5022783, KB5022784, KB5022785, KB5022786, KB5022838, KB5022858
- CVE Reference
- CVE-2023-21722, CVE-2023-21808
- CVSS Scores
- Base 7.2 / Temporal 5.3
- Description
-
A Denial of Service and Remote Code Execution Vulnerability exist in Microsoft .Net Framework.
Following KBs are covered in this detection:
KB5022838
KB5022503
KB5022729
KB5022732
KB5022784
KB5022727
KB5022782
KB5022731
KB5022783
KB5022858
KB5022734
KB5022786
KB5022497
KB5022728
KB5022730
KB5022735
KB5022733
KB5022785
This security update is rated Important for supported versions of Microsoft .NET Framework.
.NET Framework 2.0, 3.0, 3.5, 3.5.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, and 4.8.1
QID Detection Logic (Authenticated):
Checks for vulnerable file.version of ntoskrnl.exe or Mscorlib.dll or System.core.dll for the respective .Net Framework KBs
- Consequence
-
Successful exploitation may allow a attacker to perform Denial of Service or Remote Code Execution Vulnerability.
- Solution
-
Customers are advised to refer to CVE-2023-21722 and CVE-2023-21808 for more details pertaining to these vulnerabilities.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-21722
CVE-2023-21808
-
Microsoft Dynamics Security Update for February 2023
- Severity
- Serious 3
- Qualys ID
- 91978
- Vendor Reference
- CVE-2023-21570, CVE-2023-21571, CVE-2023-21572, CVE-2023-21573, CVE-2023-21807
- CVE Reference
- CVE-2023-21570, CVE-2023-21571, CVE-2023-21572, CVE-2023-21573, CVE-2023-21807
- CVSS Scores
- Base 6.4 / Temporal 4.7
- Description
-
Microsoft Dynamics contains the following vulnerabilities:
Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability.Affected Software:
Microsoft Dynamics 365 (on-premises) version 9.0
Microsoft Dynamics 365 (on-premises) version 9.1QID Detection Logic:
This QID detects vulnerable versions by checking if the version of Microsoft.Crm.Setup.Server.exe is lesser than the affected Versions:
- Consequence
- Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
- Solution
-
Customers are advised to refer to CVE-2023-21573,CVE-2023-21572,
CVE-2023-21571,
CVE-2023-21570,
CVE-2023-21807,for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-21570
CVE-2023-21571
CVE-2023-21572
CVE-2023-21573
CVE-2023-21807
-
Microsoft Windows Security Update for February 2023
- Severity
- Critical 4
- Qualys ID
- 91979
- Vendor Reference
- KB5022834, KB5022836, KB5022838, KB5022840, KB5022842, KB5022845, KB5022858, KB5022872, KB5022874, KB5022890, KB5022893, KB5022894, KB5022895, KB5022899, KB5022903, KB5022921
- CVE Reference
- CVE-2023-21684, CVE-2023-21685, CVE-2023-21686, CVE-2023-21687, CVE-2023-21688, CVE-2023-21689, CVE-2023-21690, CVE-2023-21691, CVE-2023-21692, CVE-2023-21693, CVE-2023-21694, CVE-2023-21695, CVE-2023-21697, CVE-2023-21699, CVE-2023-21700, CVE-2023-21701, CVE-2023-21702, CVE-2023-21797, CVE-2023-21798, CVE-2023-21799, CVE-2023-21801, CVE-2023-21802, CVE-2023-21803, CVE-2023-21804, CVE-2023-21805, CVE-2023-21811, CVE-2023-21812, CVE-2023-21813, CVE-2023-21816, CVE-2023-21817, CVE-2023-21818, CVE-2023-21819, CVE-2023-21820, CVE-2023-21822, CVE-2023-21823, CVE-2023-23376
- CVSS Scores
- Base 7.2 / Temporal 6
- Description
-
Microsoft Windows Security Update - Feburary 2023
QID Detection Logic (Authenticated):
Operating Systems: Windows Server 2012, Windows Server 2016, Windows 10, Windows 11, Windows Server 2022, Windows Server 2019, Windows Server 2008The KB Articles associated with the update:
The patch version is 6.3.9600.20815 for KB5022899
The patch version is 6.3.9600.20815 for KB5022894
The patch version is 6.2.9200.24111 for KB5022903
The patch version is 6.2.9200.24111 for KB5022895
The patch version is 10.0.14393.5717 for KB5022838
The patch version is 10.0.10240.19747 for KB5022858
The patch version is 10.0.19041.2604 for KB5022834
The patch version is 10.0.22621.1265 for KB5022845
The patch version is 10.0.22000.1574 for KB5022836
The patch version is 10.0.20348.1547 for KB5022842
The patch version is 10.0.17763.4010 for KB5022840
The patch version is 6.1.7601.26362 for KB5022872
The patch version is 6.1.7601.26362 for KB5022874
The patch version is 6.0.6003.21911 for KB5022890
The patch version is 6.0.6003.21911 for KB5022893
The patch version is 10.0.20348.1547 for KB5022921
This QID checks for the file version of ntoskrnl.exe.
- Consequence
-
Successful exploit could compromise Confidentiality, Integrity and Availability
- Solution
-
Please refer to the following KB Articles associated with the update:
KB5022899
KB5022894
KB5022903
KB5022895
KB5022838
KB5022858
KB5022834
KB5022845
KB5022836
KB5022842
KB5022840
KB5022872
KB5022874
KB5022890
KB5022893
KB5022921
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5022834
KB5022835
KB5022836
KB5022838
KB5022840
KB5022842
KB5022845
KB5022858
KB5022872
KB5022874
KB5022890
KB5022893
KB5022894
KB5022895
KB5022899
KB5022903
KB5022921
-
Microsoft Visual Studio Security Updates for February 2023
- Severity
- Critical 4
- Qualys ID
- 91980
- Vendor Reference
- CVE-2023-21566, CVE-2023-21567, CVE-2023-21808, CVE-2023-21815, CVE-2023-23381, CVE-2023-41953
- CVE Reference
- CVE-2023-21566, CVE-2023-21567, CVE-2023-21808, CVE-2023-21815, CVE-2023-23381, CVE-2023-41953
- CVSS Scores
- Base 4.6 / Temporal 3.4
- Description
-
Microsoft has released security Updates for Visual Studio which resolve Remote Code Execution, Denial of Service and Escalation of Priviledge Vulnerabilities.
Affected Software:
Microsoft Visual Studio 2022 version 17.4
Microsoft Visual Studio 2022 version 17.2
Microsoft Visual Studio 2022 version 17.0
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)
QID Detection Logic: Authenticated : Windows
This QID detects vulnerable versions of Microsoft Visual Studio by checking the registry key "HKLM\SOFTWARE\Microsoft" and file "evenv.exe" to check the version of the Visual Studio.
- Consequence
-
Vulnerable versions of Microsoft Visual Studio are prone to Remote Code Execution, Denial of Service and Escalation of Priviledge Vulnerabilities.
- Solution
-
Customers are advised to refer to CVE-2023-21815 and CVE-2023-23381 and CVE-2023-21567 and CVE-2023-21566 and CVE-2023-21808 and CVE-2023-41953for more information pertaining to this vulnerability
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-21566
CVE-2023-21567
CVE-2023-21808
CVE-2023-21815
CVE-2023-23381
CVE-2023-41953
-
Microsoft Dynamics Unified Service Desk Remote Code Execution (RCE) Vulnerability
- Severity
- Critical 4
- Qualys ID
- 91981
- Vendor Reference
- CVE-2023-21778
- CVE Reference
- CVE-2023-21778
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Unified Service Desk assists an agent to view the data stored in the Dynamic 365 Customer Engagement app in a holistic manner.
CVE-2023-21778:Microsoft Dynamics Unified Service Desk Remote Code Execution Vulnerability.
Affected Software:
Microsoft Dynamics Unified Service Desk prior to 4.2.0.51.
QID Detection Logic(Authenticated):
This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file UnifiedServiceDesk.exe.
- Consequence
- The attacker might be able to call victim's local files in the Resources directory and execute Windows commands that are outside of the Dynamics application.
- Solution
-
Customers are advised to refer to CVE-2023-21778
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-21778
-
Microsoft Power BI Report Server Update for February 2023
- Severity
- Critical 4
- Qualys ID
- 91982
- Vendor Reference
- CVE-2023-21806
- CVE Reference
- CVE-2023-21806
- CVSS Scores
- Base 6.4 / Temporal 4.7
- Description
-
Power BI Report Server, available as part of Power BI Premium, enables on-premises web and mobile viewing of Power BI reports, plus the enterprise reporting capabilities of SQL Server Reporting Services.
Affected Versions:
Power BI Report Server (September 2022) - file version: 15.0.1110.135 Power BI Report Server (September 2022)- file version: 15.0.1110.120 Power BI Report Server (May 2022)- file version: 15.0.1108.297 QID Detection Logic:
This authenticated QID detects vulnerable versions of RSHostingService.exe by fetching the service installed path from the HKLM\SYSTEM\CurrentControlSet\Services\PowerBIReportServer registry key. - Consequence
-
Successful exploitation can lead to spoofing vulnerability
- Solution
-
Customers are advised to refer to CVE-2023-21806 for more information pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-21806
-
Microsoft SQL Server Remote Code Execution (RCE) Vulnerability for February 2023
- Severity
- Critical 4
- Qualys ID
- 91983
- Vendor Reference
- CVE-2023-21528, CVE-2023-21568, CVE-2023-21704, CVE-2023-21705, CVE-2023-21713, CVE-2023-21718
- CVE Reference
- CVE-2023-21528, CVE-2023-21568, CVE-2023-21704, CVE-2023-21705, CVE-2023-21713, CVE-2023-21718, CVE-2023-23384
- CVSS Scores
- Base 6 / Temporal 4.4
- Description
-
Microsoft SQL Server prone to Remote Code Execution Vulnerability.
Affected Software:
SQL Server 2022 RTM (GDR)
SQL Server 2019 RTM (GDR,CU18)
SQL Server 2017 RTM (GDR,CU31)
SQL Server 2016 Service Pack 3(GDR)
SQL Server 2014 Service Pack 3 (GDR, CU4)
SQL Server 2008 R2 Service Pack 3 (GDR)
QID Detection Logic (Authenticated):
Detection looks for Microsoft SQL Server instances and checks sqlservr.exe file version - Consequence
-
Successful exploitation could lead to remote code execution
- Solution
-
Customers are advised to refer to
KB5021522
KB5021124
KB5021126
KB5021045
KB5021127
KB5021037
KB5021129
KB5021125
KB5021128
KB5021112
for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5021037
KB5021045
KB5021124
KB5021125
KB5021126
KB5021127
KB5021128
KB5021129
KB5021522
-
Microsoft Windows Server Privilege Escalation Vulnerability
- Severity
- Critical 4
- Qualys ID
- 91984
- Vendor Reference
- KB5022872, KB5022874, KB5022890, KB5022893
- CVE Reference
- CVE-2023-21800
- CVSS Scores
- Base 10 / Temporal 7.8
- Description
-
Microsoft Windows Server Security Update - Feburary 2023
QID Detection Logic (Authenticated):
Operating Systems: Windows Server 2008, Windows Server 2008 R2The KB Articles associated with the update:
The patch version is 6.1.7601.26362 for KB5022872
The patch version is 6.1.7601.26362 for KB5022874
The patch version is 6.0.6003.21911 for KB5022890
The patch version is 6.0.6003.21911 for KB5022893This QID checks for the file version of ntoskrnl.exe.
- Consequence
- Successful exploitation of this vulnerability may allow a low privileged attacker to execute code with elevated permissions.
- Solution
-
Please refer to the following KB Articles associated with the update:
KB5022872
KB5022874
KB5022890
KB5022893
Patches:
The following are links for downloading patches to fix these vulnerabilities:
KB5022872
KB5022874
KB5022890
KB5022893
-
Azure DevOps Server Multiple Vulnerabilities for February 2023
- Severity
- Critical 4
- Qualys ID
- 91985
- Vendor Reference
- CVE-2023-21553, CVE-2023-21564
- CVE Reference
- CVE-2023-21553, CVE-2023-21564
- CVSS Scores
- Base 9.3 / Temporal 6.9
- Description
-
Azure DevOps Server is a Microsoft product that provides version control, reporting, requirements management, project management, automated builds, testing, and release management capabilities.
CVE-2023-21564: Azure DevOps Server Cross-Site Scripting Vulnerability.
CVE-2023-21553: Azure DevOps Server Remote Code Execution Vulnerability.Affected Software:
Azure DevOps Server 2022.
Azure DevOps Server 2020.1.2QID Detection Logic(Authenticated):
This authenticated QID flags vulnerable systems by detecting Vulnerable versions for file Microsoft.TeamFoundation.Framework.Server.dll.
- Consequence
- Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
- Solution
-
Customers are advised to refer to CVE-2023-21564, CVE-2023-21553, for more details.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-21553
CVE-2023-21564
-
Microsoft .NET Security Update for February 2023
- Severity
- Critical 4
- Qualys ID
- 91986
- Vendor Reference
- CVE-2023-21808
- CVE Reference
- CVE-2023-21808
- CVSS Scores
- Base 4.6 / Temporal 3.4
- Description
-
Microsoft has released a security Update for .NET which resolves Remote Code Execution Vulnerability.
This security update is rated Important for affected versions of .NETAffected versions:
.NET 6.0 before version 6.0.14
.NET 7.0 before version 7.0.3
QID Detection Logic: Authenticated
On Windows, this QID detects vulnerable versions of Microsoft .NET by checking the file version.
On Linux, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" and "/root/shared/Microsoft.NETCore.App" folders.
On Mac, this QID detects vulnerable versions of Microsoft .NET by checking the .NET version present in "/usr/share/dotnet/shared/Microsoft.NETCore.App/" folder.
- Consequence
-
Vulnerable versions of Microsoft .NET are prone to Remote Code Execution Vulnerability.
- Solution
-
Customers are advised to refer to CVE-2023-21808 for more details pertaining to this vulnerability.
Patches:
The following are links for downloading patches to fix these vulnerabilities:
CVE-2023-21808
These new vulnerability checks are included in Qualys vulnerability signature 2.5.700-3. Each Qualys account is automatically updated with the latest vulnerability signatures as they become available. To view the vulnerability signature version in your account, from the Qualys Help menu, select the About tab.
Selective Scan Instructions Using Qualys
To perform a selective vulnerability scan, configure a scan profile to use the following options:
- Ensure access to TCP ports 135 and 139 are available.
- Enable Windows Authentication (specify Authentication Records).
-
Enable the following Qualys IDs:
- 110426
- 110427
- 50125
- 91975
- 91977
- 91978
- 91979
- 91980
- 91981
- 91982
- 91983
- 91984
- 91985
- 91986
- If you would like the scan to return the Windows Hostname, also include QID 82044 and ensure access to UDP port 137 is available.
- If you would like to be notified if Qualys is unable to log on to a host (if Authentication fails), also include QID 105015.
In addition, prior to running a scan for these new vulnerabilities, you can estimate your exposure to these new threats by running the Risk Analysis Report, available from the Qualys Vulnerability Management Reports tab.
Access for Qualys Customers
Platforms and Platform Identification
Technical Support
For more information, customers may contact Qualys Technical Support.
About Qualys
The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.